@owox/backend 0.37.0 → 0.39.0

package/dist/src/ee/mcp/tools/search-data-marts.tool.js

@@ -13,6 +13,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SearchDataMartsTool = void 0;
+const context_input_1 = require("./context-input");
+const mcp_contexts_facade_1 = require("../../../data-marts/facades/mcp-contexts.facade");
 const common_1 = require("@nestjs/common");
 const zod_v4_1 = require("zod-v4");
 const search_facade_1 = require("../../../common/search/search.facade");
@@ -28,6 +30,7 @@ const DEFAULT_LIMIT = 10;
 const MAX_LIMIT = 25;
 const inputSchema = zod_v4_1.z
     .object({
+    context_ids: context_input_1.contextIdsSchema,
     prompt: zod_v4_1.z.string().trim().min(2).max(256),
     limit: zod_v4_1.z.number().int().min(1).max(MAX_LIMIT).optional(),
 })
@@ -37,8 +40,9 @@ let SearchDataMartsTool = class SearchDataMartsTool {
     publicOriginService;
     projectContext;
     dataMarts;
+    contexts;
     name = 'get_relevant_data_marts_by_prompt';
-    description = 'Find relevant non-draft data marts in the current OWOX project from a natural-language prompt, limited to data marts visible to the current MCP user. This is the default discovery step for a concrete analytical question when the data mart has not already been confirmed. Use it when the user asks to find, discover, or search published data marts by title, description, business meaning, schema fields, or metrics. This tool returns only data marts, not data storages or destinations, and it intentionally excludes draft data marts.';
+    description = 'Find relevant non-draft data marts in the current OWOX project from a natural-language prompt, limited to data marts visible to the current MCP user. This is the default discovery step for a concrete analytical question when the data mart has not already been confirmed. Use it when the user asks to find, discover, or search published data marts by title, description, business meaning, schema fields, or metrics. This tool returns only data marts, not data storages or destinations, and it intentionally excludes draft data marts. Use get_project_context → list_contexts to discover business goals, then pass context_ids to restrict discovery to any selected context; omission preserves project-wide discovery within your existing access. Responses include all attached context IDs and names.';
     zodSchema = inputSchema.shape;
     outputSchema = {
         project: zod_v4_1.z.object({ id: zod_v4_1.z.string(), title: zod_v4_1.z.string() }).optional(),
@@ -46,6 +50,7 @@ let SearchDataMartsTool = class SearchDataMartsTool {
             id: zod_v4_1.z.string(),
             title: zod_v4_1.z.string(),
             description: zod_v4_1.z.string(),
+            contexts: (0, context_input_1.makeContextSummariesSchema)(),
             url: zod_v4_1.z.string(),
             relevance_score: zod_v4_1.z.number(),
         })),
@@ -60,22 +65,26 @@ let SearchDataMartsTool = class SearchDataMartsTool {
         openWorldHint: false,
     };
     requiredScopes = ['mcp:read'];
-    constructor(searchFacade, publicOriginService, projectContext, dataMarts) {
+    constructor(searchFacade, publicOriginService, projectContext, dataMarts, contexts) {
         this.searchFacade = searchFacade;
         this.publicOriginService = publicOriginService;
         this.projectContext = projectContext;
         this.dataMarts = dataMarts;
+        this.contexts = contexts;
     }
     parseInput(input) {
         return inputSchema.parse(input);
     }
     async handler(input, context) {
         const parsed = this.parseInput(input);
+        if (parsed.context_ids)
+            await this.contexts.validateContextIds(context.projectId, parsed.context_ids);
         const [results, projectContext] = await Promise.all([
             this.searchFacade.search(context.projectId, parsed.prompt, {
                 topK: parsed.limit ?? DEFAULT_LIMIT,
                 entityTypes: [search_facade_1.SearchableEntityType.DATA_MART],
                 excludeDrafts: true,
+                ...(parsed.context_ids ? { contextIds: parsed.context_ids } : {}),
                 accessScope: {
                     userId: context.userId,
                     roles: context.roles,
@@ -83,6 +92,9 @@ let SearchDataMartsTool = class SearchDataMartsTool {
             }),
             (0, mcp_project_summary_util_1.tryGetMcpProjectSummary)(this.projectContext, context),
         ]);
+        const attachedContexts = await this.contexts.getDataMartContexts(context.projectId, results
+            .filter(result => result.entityType === search_facade_1.SearchableEntityType.DATA_MART)
+            .map(result => result.entityId));
         const publicOrigin = this.publicOriginService.getPublicOrigin();
         const dataMarts = results
             .filter(result => result.entityType === search_facade_1.SearchableEntityType.DATA_MART)
@@ -91,6 +103,7 @@ let SearchDataMartsTool = class SearchDataMartsTool {
             title: result.title,
             description: result.description ?? '',
             url: (0, mcp_public_url_util_1.joinPublicOrigin)(publicOrigin, (0, data_mart_ui_path_1.buildDataMartUiPath)(context.projectId, result.entityId)),
+            contexts: attachedContexts[result.entityId] ?? [],
             relevance_score: result.finalScore,
         }));
         const gettingStarted = dataMarts.length === 0
@@ -110,6 +123,7 @@ exports.SearchDataMartsTool = SearchDataMartsTool = __decorate([
     __param(0, (0, common_1.Inject)(search_facade_1.SEARCH_FACADE)),
     __param(2, (0, common_1.Inject)(mcp_project_context_facade_1.MCP_PROJECT_CONTEXT_FACADE)),
     __param(3, (0, common_1.Inject)(mcp_data_marts_facade_1.MCP_DATA_MARTS_FACADE)),
-    __metadata("design:paramtypes", [Object, public_origin_service_1.PublicOriginService, Object, Object])
+    __param(4, (0, common_1.Inject)(mcp_contexts_facade_1.MCP_CONTEXTS_FACADE)),
+    __metadata("design:paramtypes", [Object, public_origin_service_1.PublicOriginService, Object, Object, Object])
 ], SearchDataMartsTool);
 //# sourceMappingURL=search-data-marts.tool.js.map

package/dist/src/ee/mcp/transport/mcp-http-entry.service.js

@@ -49,7 +49,7 @@ let McpHttpEntryService = McpHttpEntryService_1 = class McpHttpEntryService {
             return;
         }
         const express = this.adapterHost.httpAdapter.getInstance();
-        this.handler = (0, server_1.createMcpHandler)(({ authInfo }) => this.serverFactory.create((0, mcp_auth_middleware_1.toMcpAuthContext)(authInfo), this.instructionsService.getInstructions()), { onerror: error => this.onTransportError(error) });
+        this.handler = (0, server_1.createMcpHandler)(({ authInfo, era }) => this.serverFactory.create((0, mcp_auth_middleware_1.toMcpAuthContext)(authInfo), this.instructionsService.getInstructions(), { era, notifyToolsChanged: () => this.handler?.notify.toolsChanged() }), { onerror: error => this.onTransportError(error) });
         const nodeHandler = (0, node_1.toNodeHandler)(this.handler, {
             onerror: error => this.onTransportError(error),
         });

package/dist/src/idp/decorators/auth-context.decorator.js

@@ -22,6 +22,7 @@ function getAuthorizationContext(request) {
             pluginId: request.idpContext.pluginId,
             installationId: request.idpContext.installationId,
             viewOnly: request.idpContext.viewOnly,
+            executionId: request.idpContext.executionId,
         };
     }
     throw new common_1.BadRequestException('Invalid authentication context');

package/dist/src/idp/guards/idp.guard.d.ts

@@ -19,6 +19,7 @@ export interface AuthenticatedRequest extends Request {
         pluginId?: string;
         installationId?: string;
         viewOnly?: boolean;
+        executionId?: string;
     };
 }
 export declare const AUTH_CONTEXT = "AuthContext";
@@ -31,10 +32,12 @@ export declare class IdpGuard implements CanActivate {
     constructor(reflector: Reflector, idpProviderService: IdpProviderService, cls: ClsService, idpProjectionsService: IdpProjectionsService, moduleRef: ModuleRef);
     canActivate(context: ExecutionContext): Promise<boolean>;
     private authenticateUser;
+    private authenticateExecution;
     private checkViewOnlyRestrictions;
     private checkApiKeyHeaderBinding;
     private checkApiKeyUsageRestrictions;
     private checkPluginRuntimeAuthorization;
+    private runtimeAuthorizer;
     private isNonEmptyString;
     private static readonly ROLE_DISPLAY_NAMES;
     private checkRoleAuthorization;

package/dist/src/idp/guards/idp.guard.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdpGuard = exports.AUTH_CONTEXT = void 0;
 const common_1 = require("@nestjs/common");
 const idp_protocol_1 = require("@owox/idp-protocol");
+const business_violation_exception_1 = require("../../common/exceptions/business-violation.exception");
 const idp_projections_service_1 = require("../services/idp-projections.service");
 const types_1 = require("../types");
 const core_1 = require("@nestjs/core");
@@ -78,6 +79,7 @@ let IdpGuard = class IdpGuard {
                 pluginId: tokenPayload.pluginId,
                 installationId: tokenPayload.installationId,
                 viewOnly,
+                executionId: tokenPayload.executionId,
             };
             this.cls.set(exports.AUTH_CONTEXT, {
                 userId: tokenPayload.userId,
@@ -88,13 +90,16 @@ let IdpGuard = class IdpGuard {
                 pluginId: tokenPayload.pluginId,
                 installationId: tokenPayload.installationId,
                 viewOnly,
+                executionId: tokenPayload.executionId,
             });
             if (request && STATE_CHANGING_METHODS.includes(request.method)) {
                 void this.idpProjectionsService.updateProjectionsFromIdpPayload(tokenPayload);
             }
         }
         catch (error) {
-            if (error instanceof common_1.UnauthorizedException || error instanceof idp_protocol_1.AuthorizationError) {
+            if (error instanceof common_1.UnauthorizedException ||
+                error instanceof idp_protocol_1.AuthorizationError ||
+                (error instanceof business_violation_exception_1.BusinessViolationException && error.code === 'PLUGIN_SUSPENDED')) {
                 throw error;
             }
             throw new idp_protocol_1.AuthenticationError('Authentication failed');
@@ -105,6 +110,10 @@ let IdpGuard = class IdpGuard {
         return true;
     }
     async authenticateUser(request, strategy) {
+        const executionToken = request.headers['x-owox-execution-token'];
+        if (executionToken !== undefined) {
+            return this.authenticateExecution(request, executionToken);
+        }
         const idpProvider = this.idpProviderService.getProvider(request);
         const token = request.headers['x-owox-authorization'] ?? '';
         const tokenPayload = strategy === types_1.Strategy.PARSE
@@ -113,7 +122,25 @@ let IdpGuard = class IdpGuard {
         if (!tokenPayload) {
             throw new idp_protocol_1.AuthenticationError('Invalid authorization');
         }
-        return tokenPayload;
+        return { ...tokenPayload, executionId: undefined };
+    }
+    async authenticateExecution(request, executionToken) {
+        if (Array.isArray(executionToken) || request.headers['x-owox-authorization'] !== undefined) {
+            throw new idp_protocol_1.AuthenticationError('Send one authorization header');
+        }
+        const identity = await this.runtimeAuthorizer().resolveExecutionToken(executionToken);
+        if (!identity) {
+            throw new idp_protocol_1.AuthenticationError('Invalid execution token');
+        }
+        return {
+            userId: identity.userId,
+            projectId: identity.projectId,
+            roles: [identity.role],
+            authFlow: 'plugin',
+            pluginId: identity.pluginId,
+            installationId: identity.installationId,
+            executionId: identity.executionId,
+        };
     }
     checkViewOnlyRestrictions(request, tokenPayload, viewOnlySafe) {
         if (!(0, idp_protocol_1.isViewOnlyPayload)(tokenPayload)) {
@@ -161,6 +188,14 @@ let IdpGuard = class IdpGuard {
             !this.isNonEmptyString(tokenPayload.userId)) {
             throw new idp_protocol_1.AuthorizationError('Invalid plugin runtime identity');
         }
+        await this.runtimeAuthorizer().assertActiveInstallation({
+            pluginId: tokenPayload.pluginId,
+            installationId: tokenPayload.installationId,
+            projectId: tokenPayload.projectId,
+            userId: tokenPayload.userId,
+        });
+    }
+    runtimeAuthorizer() {
         let authorizer;
         try {
             authorizer = this.moduleRef.get(plugin_runtime_authorizer_port_1.PLUGIN_RUNTIME_AUTHORIZER, {
@@ -173,12 +208,7 @@ let IdpGuard = class IdpGuard {
         if (!authorizer) {
             throw new idp_protocol_1.AuthorizationError('Plugin runtime authorization is unavailable');
         }
-        await authorizer.assertActiveInstallation({
-            pluginId: tokenPayload.pluginId,
-            installationId: tokenPayload.installationId,
-            projectId: tokenPayload.projectId,
-            userId: tokenPayload.userId,
-        });
+        return authorizer;
     }
     isNonEmptyString(value) {
         return typeof value === 'string' && value.trim().length > 0;

package/dist/src/idp/oauth/controllers/oauth-authorization.controller.js

@@ -19,6 +19,7 @@ const internal_helpers_1 = require("@owox/internal-helpers");
 const idp_protocol_1 = require("@owox/idp-protocol");
 const idp_provider_service_1 = require("../../services/idp-provider.service");
 const oauth_client_registry_1 = require("../oauth-client.registry");
+const mcp_client_integration_1 = require("../mcp-client-integration");
 const oauth_idp_port_1 = require("../oauth-idp.port");
 const oauth_project_selection_service_1 = require("../oauth-project-selection.service");
 const oauth_project_member_resolver_1 = require("../oauth-project-member.resolver");
@@ -66,7 +67,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         const authorizationRequest = validated.request;
         const resourceContext = validated.resourceContext;
         const provider = this.idpProviderService.getProvider(request);
-        const authorization = await this.resolveAuthorizationContext(provider, request, response);
+        const authorization = await this.resolveAuthorizationContext(provider, request, response, (0, mcp_client_integration_1.getMcpClientIntegration)(authorizationRequest.redirectUri));
         if (!authorization) {
             return;
         }
@@ -160,7 +161,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             ? this.projectSelectionService.resolveSelectedProjectMember(provider, context, projects, selectedProjectId)
             : this.projectMemberResolver.resolve(context);
     }
-    async resolveAuthorizationContext(provider, request, response) {
+    async resolveAuthorizationContext(provider, request, response, integration) {
         const accessToken = this.getHeaderValue(request, 'x-owox-authorization');
         if (accessToken) {
             const payload = await provider.parseToken(accessToken);
@@ -170,7 +171,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         }
         const refreshToken = this.getCookieValue(request, 'refreshToken');
         if (!refreshToken) {
-            this.redirectToSignIn(request, response);
+            this.redirectToSignIn(request, response, integration);
             return null;
         }
         try {
@@ -178,13 +179,13 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             this.persistRefreshTokenIfReturned(request, response, auth);
             const payload = await provider.parseToken(auth.accessToken);
             if (!payload) {
-                this.redirectToSignIn(request, response);
+                this.redirectToSignIn(request, response, integration);
                 return null;
             }
             return { context: this.toAuthorizationContext(payload), accessToken: auth.accessToken };
         }
         catch {
-            this.redirectToSignIn(request, response);
+            this.redirectToSignIn(request, response, integration);
             return null;
         }
     }
@@ -221,13 +222,14 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             maxAge: auth.refreshTokenExpiresIn * 1000,
         });
     }
-    redirectToSignIn(request, response) {
+    redirectToSignIn(request, response, integration) {
         const currentUrl = request.originalUrl || request.url;
         const host = request.get('host') ?? 'localhost';
         const signInUrl = new URL('/auth/sign-in', `${request.protocol}://${host}`);
         signInUrl.searchParams.set('redirect', currentUrl);
         signInUrl.searchParams.set('redirect-to', currentUrl);
         signInUrl.searchParams.set('app-redirect-to', currentUrl);
+        signInUrl.searchParams.set('integration', integration);
         this.logger.log('Redirecting OAuth authorize request to sign-in', {
             clientId: this.extractClientId(currentUrl, request, host),
             host,

package/dist/src/idp/oauth/mcp-client-integration.d.ts

@@ -0,0 +1 @@
+export declare function getMcpClientIntegration(redirectUri: string): string;

package/dist/src/idp/oauth/mcp-client-integration.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMcpClientIntegration = getMcpClientIntegration;
+function getMcpClientIntegration(redirectUri) {
+    const origin = new URL(redirectUri).origin;
+    switch (origin) {
+        case 'https://claude.ai':
+            return 'claude';
+        case 'https://chatgpt.com':
+            return 'chatgpt';
+        default:
+            return 'owox-data-marts';
+    }
+}
+//# sourceMappingURL=mcp-client-integration.js.map

package/dist/src/idp/ports/plugin-runtime-authorizer.port.d.ts

@@ -1,10 +1,16 @@
+import type { Role } from '@owox/idp-protocol';
 export interface PluginRuntimeIdentity {
     readonly pluginId: string;
     readonly installationId: string;
     readonly projectId: string;
     readonly userId: string;
 }
+export interface PluginExecutionIdentity extends PluginRuntimeIdentity {
+    readonly executionId: string;
+    readonly role: Role;
+}
 export declare const PLUGIN_RUNTIME_AUTHORIZER: unique symbol;
 export interface PluginRuntimeAuthorizerPort {
     assertActiveInstallation(identity: PluginRuntimeIdentity): Promise<void>;
+    resolveExecutionToken(token: string): Promise<PluginExecutionIdentity | null>;
 }

package/dist/src/idp/types/auth.types.d.ts

@@ -12,4 +12,5 @@ export interface AuthorizationContext {
     pluginId?: string;
     installationId?: string;
     viewOnly?: boolean;
+    executionId?: string;
 }

package/dist/src/migrations/1790830000000-widen-sql-dry-run-trigger-sql-column.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class WidenSqlDryRunTriggerSqlColumn1790830000000 implements MigrationInterface {
+    readonly name = "WidenSqlDryRunTriggerSqlColumn1790830000000";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790830000000-widen-sql-dry-run-trigger-sql-column.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WidenSqlDryRunTriggerSqlColumn1790830000000 = void 0;
+class WidenSqlDryRunTriggerSqlColumn1790830000000 {
+    name = 'WidenSqlDryRunTriggerSqlColumn1790830000000';
+    async up(queryRunner) {
+        if (queryRunner.connection.options.type !== 'mysql') {
+            return;
+        }
+        await queryRunner.query('ALTER TABLE `sql_dry_run_triggers` MODIFY `sql` MEDIUMTEXT NOT NULL');
+    }
+    async down(queryRunner) {
+        if (queryRunner.connection.options.type !== 'mysql') {
+            return;
+        }
+        await queryRunner.query('DELETE FROM `sql_dry_run_triggers` WHERE LENGTH(`sql`) > 65535');
+        await queryRunner.query('ALTER TABLE `sql_dry_run_triggers` MODIFY `sql` TEXT NOT NULL');
+    }
+}
+exports.WidenSqlDryRunTriggerSqlColumn1790830000000 = WidenSqlDryRunTriggerSqlColumn1790830000000;
+//# sourceMappingURL=1790830000000-widen-sql-dry-run-trigger-sql-column.js.map

package/dist/src/migrations/1790900000000-add-plugin-version-backend.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddPluginVersionBackend1790900000000 implements MigrationInterface {
+    readonly name = "AddPluginVersionBackend1790900000000";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790900000000-add-plugin-version-backend.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddPluginVersionBackend1790900000000 = void 0;
+const typeorm_1 = require("typeorm");
+const TABLE = 'plugin_version';
+const COLUMN = 'backend';
+class AddPluginVersionBackend1790900000000 {
+    name = 'AddPluginVersionBackend1790900000000';
+    async up(queryRunner) {
+        if (!(await queryRunner.hasColumn(TABLE, COLUMN))) {
+            await queryRunner.addColumn(TABLE, new typeorm_1.TableColumn({ name: COLUMN, type: 'json', isNullable: true }));
+        }
+    }
+    async down(queryRunner) {
+        if (await queryRunner.hasColumn(TABLE, COLUMN)) {
+            await queryRunner.dropColumn(TABLE, COLUMN);
+        }
+    }
+}
+exports.AddPluginVersionBackend1790900000000 = AddPluginVersionBackend1790900000000;
+//# sourceMappingURL=1790900000000-add-plugin-version-backend.js.map

package/dist/src/migrations/1790900000001-create-plugin-action-execution.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class CreatePluginActionExecution1790900000001 implements MigrationInterface {
+    readonly name = "CreatePluginActionExecution1790900000001";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790900000001-create-plugin-action-execution.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePluginActionExecution1790900000001 = void 0;
+const typeorm_1 = require("typeorm");
+const migration_utils_1 = require("./migration-utils");
+const TABLE = 'plugin_action_execution';
+class CreatePluginActionExecution1790900000001 {
+    name = 'CreatePluginActionExecution1790900000001';
+    async up(queryRunner) {
+        if (await queryRunner.hasTable(TABLE)) {
+            return;
+        }
+        const payloadType = queryRunner.connection.options.type === 'mysql' ? 'mediumtext' : 'text';
+        await queryRunner.createTable(new typeorm_1.Table({
+            name: TABLE,
+            columns: [
+                { name: 'id', type: 'varchar', length: '36', isPrimary: true },
+                { name: 'pluginId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'pluginVersionId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'installationId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'projectId', type: 'varchar', length: '255', isNullable: false },
+                { name: 'userId', type: 'varchar', length: '255', isNullable: false },
+                { name: 'action', type: 'varchar', length: '64', isNullable: false },
+                { name: 'input', type: payloadType, isNullable: true },
+                { name: 'trigger', type: 'varchar', length: '16', isNullable: false },
+                { name: 'status', type: 'varchar', length: '16', isNullable: false },
+                { name: 'role', type: 'varchar', length: '16', isNullable: false },
+                { name: 'tokenHash', type: 'varchar', length: '64', isNullable: true },
+                { name: 'deadlineAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'createdAt', type: 'datetime', default: 'CURRENT_TIMESTAMP' },
+                { name: 'startedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'finishedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'errorCode', type: 'varchar', length: '64', isNullable: true },
+                { name: 'errorMessage', type: 'varchar', length: '1000', isNullable: true },
+                { name: 'result', type: payloadType, isNullable: true },
+                { name: 'payloadsClearedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'payloadBytes', type: 'int', isNullable: false, default: 0 },
+            ],
+        }));
+        for (const index of [
+            new typeorm_1.TableIndex({
+                name: 'UQ_plugin_action_execution_token',
+                columnNames: ['tokenHash'],
+                isUnique: true,
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_running',
+                columnNames: ['installationId', 'status'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_deadline',
+                columnNames: ['status', 'deadlineAt'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_starts',
+                columnNames: ['installationId', 'startedAt', 'payloadBytes'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_finished',
+                columnNames: ['finishedAt'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_payloads',
+                columnNames: ['payloadsClearedAt', 'finishedAt'],
+            }),
+        ]) {
+            await queryRunner.createIndex(TABLE, index);
+        }
+    }
+    async down(queryRunner) {
+        if (await queryRunner.hasTable(TABLE)) {
+            await (0, migration_utils_1.softDropTable)(queryRunner, TABLE);
+        }
+    }
+}
+exports.CreatePluginActionExecution1790900000001 = CreatePluginActionExecution1790900000001;
+//# sourceMappingURL=1790900000001-create-plugin-action-execution.js.map

package/dist/src/migrations/1791000000000-add-credential-public-metadata.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddCredentialPublicMetadata1791000000000 implements MigrationInterface {
+    readonly name = "AddCredentialPublicMetadata1791000000000";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1791000000000-add-credential-public-metadata.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddCredentialPublicMetadata1791000000000 = void 0;
+const typeorm_1 = require("typeorm");
+const CREDENTIAL = 'credential';
+const COLUMN = 'publicMetadata';
+class AddCredentialPublicMetadata1791000000000 {
+    name = 'AddCredentialPublicMetadata1791000000000';
+    async up(queryRunner) {
+        if ((await queryRunner.hasTable(CREDENTIAL)) &&
+            !(await queryRunner.hasColumn(CREDENTIAL, COLUMN))) {
+            await queryRunner.addColumn(CREDENTIAL, new typeorm_1.TableColumn({ name: COLUMN, type: 'json', isNullable: true }));
+        }
+    }
+    async down(queryRunner) {
+        if ((await queryRunner.hasTable(CREDENTIAL)) &&
+            (await queryRunner.hasColumn(CREDENTIAL, COLUMN))) {
+            await queryRunner.dropColumn(CREDENTIAL, COLUMN);
+        }
+    }
+}
+exports.AddCredentialPublicMetadata1791000000000 = AddCredentialPublicMetadata1791000000000;
+//# sourceMappingURL=1791000000000-add-credential-public-metadata.js.map

package/dist/src/plugin-host/collections/dto/domain/plugin-collection.types.d.ts

@@ -20,6 +20,7 @@ export interface PluginCollectionPageDto {
 }
 export interface ResolvedPluginCollection {
     readonly declaration: PluginCollectionDeclaration;
+    readonly semver: string;
     readonly namespaceKey: string;
     readonly memberId: string | null;
 }

package/dist/src/plugin-host/collections/errors/plugin-collection.errors.d.ts

@@ -7,6 +7,12 @@ export declare class PluginCollectionAuthorizationDeniedError extends ForbiddenE
 }
 export declare class PluginCollectionValidationError extends BadRequestException {
 }
+export declare class PluginCollectionNotEntityBoundError extends PluginCollectionValidationError {
+    constructor(collectionName: string, semver: string);
+}
+export declare class PluginCollectionParentIdRequiredError extends PluginCollectionValidationError {
+    constructor(collectionName: string, entityType: string, semver: string);
+}
 export declare class PluginCollectionQuotaExceededError extends PayloadTooLargeException {
     constructor(limit: string);
 }

package/dist/src/plugin-host/collections/errors/plugin-collection.errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PluginCollectionQuotaExceededError = exports.PluginCollectionValidationError = exports.PluginCollectionAuthorizationDeniedError = exports.PluginCollectionNotFoundError = void 0;
+exports.PluginCollectionQuotaExceededError = exports.PluginCollectionParentIdRequiredError = exports.PluginCollectionNotEntityBoundError = exports.PluginCollectionValidationError = exports.PluginCollectionAuthorizationDeniedError = exports.PluginCollectionNotFoundError = void 0;
 const common_1 = require("@nestjs/common");
 class PluginCollectionNotFoundError extends common_1.NotFoundException {
     constructor() {
@@ -17,6 +17,24 @@ exports.PluginCollectionAuthorizationDeniedError = PluginCollectionAuthorization
 class PluginCollectionValidationError extends common_1.BadRequestException {
 }
 exports.PluginCollectionValidationError = PluginCollectionValidationError;
+class PluginCollectionNotEntityBoundError extends PluginCollectionValidationError {
+    constructor(collectionName, semver) {
+        super({
+            code: 'PLUGIN_COLLECTION_NOT_ENTITY_BOUND',
+            message: `Collection "${collectionName}" has no entityBinding in plugin.json of the current version ${semver}, so put does not accept parentId`,
+        });
+    }
+}
+exports.PluginCollectionNotEntityBoundError = PluginCollectionNotEntityBoundError;
+class PluginCollectionParentIdRequiredError extends PluginCollectionValidationError {
+    constructor(collectionName, entityType, semver) {
+        super({
+            code: 'PLUGIN_COLLECTION_PARENT_ID_REQUIRED',
+            message: `Collection "${collectionName}" has an entityBinding to ${entityType} in plugin.json of the current version ${semver}, so put requires parentId`,
+        });
+    }
+}
+exports.PluginCollectionParentIdRequiredError = PluginCollectionParentIdRequiredError;
 class PluginCollectionQuotaExceededError extends common_1.PayloadTooLargeException {
     constructor(limit) {
         super(`Plugin collection limit exceeded: ${limit}`);

package/dist/src/plugin-host/collections/services/plugin-collection-declaration.service.js

@@ -27,8 +27,8 @@ let PluginCollectionDeclarationService = class PluginCollectionDeclarationServic
         if (!plugin?.currentVersionId)
             throw new plugin_collection_errors_1.PluginCollectionNotFoundError();
         const version = await this.versions.findById(plugin.currentVersionId);
-        const declaration = (version?.collections ?? []).find(item => item.name === collectionName);
-        if (!declaration)
+        const declaration = version?.collections?.find(item => item.name === collectionName);
+        if (!version || !declaration)
             throw new plugin_collection_errors_1.PluginCollectionNotFoundError();
         const memberId = declaration.scope === 'member' ? context.userId : null;
         const namespaceKey = (0, node_crypto_1.createHash)('sha256')
@@ -40,7 +40,7 @@ let PluginCollectionDeclarationService = class PluginCollectionDeclarationServic
             collectionName,
         ]))
             .digest('hex');
-        return { declaration, namespaceKey, memberId };
+        return { declaration, semver: version.semver, namespaceKey, memberId };
     }
 };
 exports.PluginCollectionDeclarationService = PluginCollectionDeclarationService;

package/dist/src/plugin-host/collections/use-cases/put-plugin-collection-document.service.js

@@ -27,6 +27,13 @@ let PutPluginCollectionDocumentService = class PutPluginCollectionDocumentServic
     async run(command) {
         const resolved = await this.declarations.resolve(command.collectionName, command.context);
         try {
+            const { entityBinding } = resolved.declaration;
+            if (command.parentId !== null && !entityBinding) {
+                throw new plugin_collection_errors_1.PluginCollectionNotEntityBoundError(command.collectionName, resolved.semver);
+            }
+            if (command.parentId === null && entityBinding) {
+                throw new plugin_collection_errors_1.PluginCollectionParentIdRequiredError(command.collectionName, entityBinding.type, resolved.semver);
+            }
             return await this.persistence.put(resolved, command);
         }
         catch (error) {